GitHub Advisoryadvisory · PyPI
GHSA-p8w2-f44p-fmcj Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2008-6954
- Ecosystem
- PyPI
- Packages
- cobbler
- Severity
- High
- Weaknesses
- CWE-94
- Reviewed
- 2024-02-09
Affected packages
• PyPI cobbler: < 1.2.9 → fixed in 1.2.9
Description
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Related
Alias · CVE (1)
- CVE-2008-6954 The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2008-6954 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46625 web
- https://github.com/cobbler/cobbler package
- https://web.archive.org/web/20111227125913/http://secunia.com/advisories/32804 web
- https://web.archive.org/web/20111227151912/http://secunia.com/advisories/32737 web
- https://web.archive.org/web/20200228143518/http://www.securityfocus.com/bid/32317 web
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html web
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html web
- http://freshmeat.net/projects/cobbler/releases/288374 web